They way I like to handle session tokens that seems like a good compromise between security and user friendliness: Automatically renew the token as long as the user is actively using the website. I usually use a 12 hour token and renew if it's 8 hours old or more. The renewal requires the use a second token stored locally in the browser so even if you somehow sniff the token off the wire, you still can't renew it without control of the user's browser.

And frankly if they have control of the user's browser, they could probably install a key logger anyway.

That way, if someone is constantly using the site, they would never notice a logout, but otherwise they might have to login once a day.